imminent | f5c252667a88b7f12afa26e0579036cba64c3c95180b7ad86c4f26ee26c1e922

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:01

Target

2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
Size

474KB
MD5

2feb1f47de85fc805b770965fbd56498
SHA1

2edc489027951f8c63b4db6be2bd3d27f2a1930d
SHA256

f5c252667a88b7f12afa26e0579036cba64c3c95180b7ad86c4f26ee26c1e922
SHA512

dd51f936144f4ce48dd789fc95b60f912fc4ec59427a51863de523408f53d304c5f1803b827ee4e0ef7e90976c3e8113e245649141f3c7ffb47cd11908e97ae5
SSDEEP

12288:QMfohPnK0D+Sij8vtEJc5bMD/NjlGjiw:QMfoVKXUEj

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4008 set thread context of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
Token: 33	1976	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1976	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83
PID 4008 wrote to memory of 1976	4008	2feb1f47de85fc805b770965fbd56498_JaffaCakes118.exe	83

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4744

memory/1976-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1976-5-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/1976-7-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/1976-8-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/1976-9-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/1976-17-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/1976-18-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4008-0-0x0000000074AA2000-0x0000000074AA3000-memory.dmp

Filesize
4KB

Download
memory/4008-1-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4008-2-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4008-6-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download